Re: PF dropping fragmented icmp6 packets

> I've having an odd problem with my ipv6 tunnel which seems to related to how
> I've configured pf (running on OpenBSD 3.4 i386).
> 
> This is my pf.conf file:
> 
> set block-policy return
> scrub in all
> pass in all
> pass out all
> block in all
> pass in on sis0 from 193.113.58.80 to 81.6.214.188
> pass in on sis1 inet6
> pass in on gif0 inet6 proto icmp6
> pass in on gif0 inet6 proto tcp from any to 2001:618:409::/48 port 22
> pass in on gif0 inet6 proto tcp from any to 2001:618:409::/48 port 80
> pass out on gif0 inet6 proto { tcp, udp } from 2001:618:409::/48 to any keep state
> 
> If I do a ping6 with a packet size greater than the mtu of the gif0
> interface (which is 1280) then I won't see any ping replies.
> 
> If I change the pf.conf to pass in all; pass out all; then I do see the ping
> replies.
> 
> Is an ipv6-icmp6 fragmented packet using a different protocol or is it pf
> that's a little confused?

	fragmented IPv6 packets will have different protocol type from
	normal packet (protocol number 44), so you need to let them through.

	IPv6 packet structure is totally different from IPv4, so we really
	need a way to specify intermediate header types in PF syntax
	(RFC2460 section 4 illustrates this).

> I've tried without the scrub rule also but that doesn't fix this.

	scrub for IPv6 is not implemented yet (TBD).

itojun